fixes

README.md

@@ -73,7 +73,7 @@ The Linux-side package builder validates the FreeBSD package payload before publ
 
 ## OPNsense UI
 
-The OPNsense page **Services -> RustProxy** exposes enable/disable plus HTTP, HTTPS/TLS and administration listener settings. RustProxy runs as the unprivileged `rustproxy` user.
+The OPNsense page **Services -> RustProxy** exposes enable/disable plus separate bind-address and port settings for HTTP, HTTPS/TLS and administration. On OPNsense/FreeBSD RustProxy runs as `root`.
 
 ## Validation
 
@@ -87,12 +87,12 @@ See `docs/FIRST_RUN.md` for Debian setup.
 
 The OPNsense page **Services -> RustProxy** exposes the runtime listeners used by the rc.d service:
 
-- HTTP listen: `0.0.0.0:8080`
-- HTTPS/TLS listen: `0.0.0.0:8181` (toggleable)
-- Admin listen: `0.0.0.0:9090`
+- HTTP bind address + port: `0.0.0.0` / `8080`
+- HTTPS/TLS bind address + port: `0.0.0.0` / `8181` (toggleable)
+- Admin bind address + port: `0.0.0.0` / `9090`
 - Allow remote admin: on by default so the RustProxy panel can be reached from other hosts; OPNsense firewall rules still decide which networks can connect
 
-The service runs as the unprivileged `rustproxy` user and keeps `/var/db/rustproxy` mode `0700`, as required by RustProxy. Package installation restarts `configd` so `configctl rustproxy ...` actions are immediately available even after direct `pkg add`.
+On OPNsense/FreeBSD the service runs as `root` and keeps `/var/db/rustproxy` mode `0700`. This avoids startup/access failures seen after privilege dropping with `daemon -u rustproxy`. Package installation restarts `configd` so `configctl rustproxy ...` actions are immediately available even after direct `pkg add`.
 
 ## FreeBSD/OPNsense-only RustProxy patches
 
@@ -108,4 +108,8 @@ Set `APPLY_FREEBSD_PATCHES=0` in `/etc/rustproxy-opnsense-builder.env` only when
 
 ### Runtime PID directory
 
-The OPNsense rc.d service creates `/var/run/rustproxy` as `rustproxy:rustproxy` (0750) on every start. Both supervisor and child PID files live there so `daemon -u rustproxy` can run without root-owned PID-file errors.
+The OPNsense rc.d service creates `/var/run/rustproxy` as `root:wheel` (0750) on every start. Both supervisor and child PID files live there. The runtime is kept as root on OPNsense/FreeBSD because privilege dropping caused real-world startup and data/certificate access failures.
+
+### Listener compatibility note
+
+Plugin model 1.3 stores bind addresses and ports separately. This prevents malformed rendered arguments such as `--tls-listen 0.0.0.0:`. Existing 1.2.x combined `proxyListen`, `tlsListen` and `adminListen` values remain accepted by rc.d during upgrades. If a legacy value is malformed, rc.d falls back to the documented default instead of passing an invalid listener to RustProxy.